With their combined call for a top-down, risk-based assessment of internal controls over financial reporting and a single, more focused audit opinion, the Securities and Exchange Commission and the Public Company Accounting Oversight Board are at least on the right path in curbing excessive auditing.
But the call for a single audit opinion won’t, by itself, help reduce the chronic complaint of over-auditing.
That’s the initial reaction from a handful of thought leaders, who spent the holidays reviewing regulatory proposals meant to throttle back the controversial—many would say unfair and overwhelming—Sarbanes-Oxley Section 404 requirement to report on internal controls.
Cunningham
“It’s a step in the right direction,” says Colleen Cunningham, president of Financial Executives International. Cunningham is an outspoken critic of Auditing Standard No. 2, the PCAOB’s rule governing how audit firms should conduct audits of internal controls. Broadly speaking, however, Cunningham likes what she has seen so far in the proposed changes to AS2.
“It will be interesting to see what the auditors’ feedback is, since they’re the ones who have to comply with it,” she says. “Auditors are justifiably skittish, so it depends on how they react and how the firms’ processes and training change as a result of a new standard. It should be very, very helpful.”
A key provision of the new audit rules is the elimination of one of the currently required two audit opinions related to internal control. The SEC has proposed amending Regulation S-X, which governs the filing of financial reports, to require the audit report to “clearly state the opinion of the accountant, either unqualified or adverse, as to whether the registrant maintained in all material respects, effective internal control over financial reporting.”
Likewise, the PCAOB’s proposed new audit standard would direct the auditor to issue a report that addresses “the auditor’s opinion on whether the company maintained, in all material respects, effective internal control over financial reporting as of the specified date, based on the control criteria.”
Currently, AS2 requires auditors to issue that opinion, plus an opinion on whether management’s assessment of internal control is fairly stated. Separately, the standard also directs auditors to size up management’s assessment process as part of the auditors’ own process to reach sound conclusions.
That requirement in AS2—for auditors to evaluate management’s assessment process—has led to some confusion and debate over the opinions auditors are supposed to issue. PCAOB Deputy Chief Auditor Laura Phillips acknowledged as much when the Board unveiled its proposals on Dec. 19.
Phillips
The new standard “clearly states the report only needs to include a single opinion, and the opinion is the statement of the auditor’s belief about whether the internal control is effective,” she said. “The opinion about ‘fairly stated’ goes away.”
Phillips said the new language is not only clearer and easier to understand, but that it is expected to affect the scope of audit work. “We’ve gotten the impression that there are some folks including auditors who misunderstood what that second opinion on management’s assessment meant,” she said. “It’s the term ‘management assessment’ that led to some confusion. A lot of folks used that term in another context to mean management’s assessment process.”
Rittenberg
COSO Chairman Larry Rittenberg says the new language around a single opinion makes the requirements clearer. “It makes it much more analogous to what auditors have always done in the opinion on financial statements,” he says. “They give an opinion on the financial statements, not on the job management did to put the financial statements together.”
PROPOSAL
An excerpt follows from the PCAOB’s proposed auditing standard.
Reporting on Internal Control
The auditor's report on management's assessment of the effectiveness of internal control over financial reporting must include the following elements:
A title that includes the word independent;
An identification of management's conclusion about the effectiveness of the company's internal control over financial reporting as of a specified date based on the control criteria;
An identification of management's assessment (the auditor should use the same description of the company's internal control over financial reporting as management uses in its annual report);
A statement that the assessment is the responsibility of management;
A statement that the auditor's responsibility is to express an opinion on the company's internal control over financial reporting based on his or her audit;
A definition of internal control over financial reporting as stated in paragraph A5;
A statement that the audit was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States);
A statement that the standards of the Public Company Accounting Oversight Board require that the auditor plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects;
A statement that an audit includes obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as the auditor considered necessary in the circumstances;
A statement that the auditor believes the audit provides a reasonable basis for his or her opinion;
A paragraph stating that, because of inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate;
The auditor's opinion on whether the company maintained, in all material respects, effective internal control over financial reporting as of the specified date, based on the control criteria;
The manual or printed signature of the auditor's firm;
The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor's report has been issued; and
The date of the audit report.
Source
Proposed Auditing Standard Of Internal Control Over Financial Reporting & Other Related Proposals (PCAOB; Dec. 19, 2006)
Cunningham says it’s a good idea to focus auditors on a single opinion, but she is unsure whether it alone will result in less audit work. “What it changes is the internal process for auditors to issue a second opinion, but I’m not sure it saves a lot of time,” she says. She considers the double opinion as redundant at least, if not confusing. “If [auditors] are assessing the internal control environment, who cares what management’s assessment process was, quite frankly, if it came to the same conclusion?”
Ten Eyck
Ernie Ten Eyck, an adviser to the Association of Audit Committee members, agrees that the change is substantive—at least in giving the auditor clearer direction—but doesn’t substantively change the auditor’s report.
“You can’t do everything that’s required under the revised AS2 and not have a reasonable basis for an opinion on internal control,” he says. “They haven’t really changed anything in the reporting sense by eliminating the requirement to conduct an assessment of management’s process.”
Ten Eyck said the primary focus of the new audit rules as proposed “is to reduce audit overkill, to get auditors to do less, and put less pressure on management to do an elaborate job.” The new emphasis on top-level controls and on a risk-based audit process will do more to end the overkill than the elimination of the audit opinion, he contends.
The Institute of Management Accountants says the PCAOB has the right idea in eliminating an audit opinion—but insists that regulators have dropped the wrong one. “We think that Section 404B [of Sarbanes-Oxley] asks for an evaluation of management’s process, not a statement on the bottom-line outcome,” IMA Vice President Jeff Thomson says. “By having the auditor issuing their subjective opinion on a pass or fail of effectiveness, that will continue to perpetuate inefficient and costly testing and documentation.”
Kaiser
Gordon Kaiser, an attorney with Squire Sanders & Dempsey, says he can appreciate the argument that the dropped opinion may not contribute a great deal to the efficiency of the audit.
“It skips a process that wasn’t probably helpful to begin with,” he said. “It’s been true forever that auditors, in order to reach conclusions about financial statements, have always had to look at internal controls. This is simply a more precise statement about the level of comfort auditors need to have. It’s probably easier to say, ‘You seem to have gone through the right steps to make an assessment,’ than it is to say substantively, ‘The assessment is correct’—that is, the controls are effective.”
No comments yet